Melissa Bishop
“Self-awareness is the most important professional skill you can develop. Deeply understanding our own style and capabilities can allow us to make decisions more confidently, act authentically, and coach ourselves through conflict.”
Melissa Bishop is a cybersecurity leader with more than 20+ years of experience in tech and risk management. As CISO of Corporate Services at Amazon, she oversees security for core business areas like finance, HR, and legal. Previously, she was Managing Vice President and Divisional CISO at Capital One, and held senior roles at Uber, Autodesk, and Deloitte. Melissa is known for building strong teams and aligning security with business goals.
What is one skill, interest or talent of yours that makes you great at your job?
Questions are my love language. I am truly curious about people, and I like hearing about their lives. It ends up being a natural trust builder.
What is the best piece of unconventional career advice you’ve gotten?
Self-awareness is the most important professional skill you can develop. Deeply understanding our own style and capabilities can allow us to make decisions more confidently, act authentically, and coach ourselves through conflict. Being self-aware can help to set yourself up for success.
What is your proudest moment working in the cybersecurity industry?
My proudest moments come when I’m solving hard problems with my team, having genuine interactions with peers in the industry, feeling like I helped someone else in their career or journey, and coming home to my family.
When did you become interested in pursuing a career in cyber and what prompted it?
After starting my career at Deloitte conducting technology assessments and audits, I transitioned into a governance, risk, and compliance (GRC) role within a cybersecurity team. There, I collaborated closely with every facet of the organization’s cyber functions, many of which I later joined or led. It was a pivotal foundation, though it wasn’t an overnight move; it was the result of deliberate growth and earned opportunities.
What are the top 3 things you would tell people hoping to enter the cybersecurity industry?
- There aren’t a lot of entry level security jobs, which is frustrating, but you can do it. Hang in there.
- If you aren’t finding an entry level security job, look for a job that can be a good path to security (IT, tech support, development, QA, internal audit, or consulting).
- Look for ways to incorporate security into your current role—connect with your organization’s security team, read widely on cybersecurity topics, volunteer at local security conferences, and build a solid foundation in networking and infrastructure. Prioritize certifications and courses that include hands-on labs and real-world exercises to deepen your practical skills.
What are some misconceptions people might have about the cybersecurity industry and what can we do to change these misconceptions?
One of the biggest misconceptions about cybersecurity is that it’s all about hacking into systems or constantly responding to breaches. While security testing, hacking, and incident response are important components, they’re just part of the picture. In reality, many cybersecurity professionals are builders, engineering secure, resilient systems and proactively designing solutions to prevent issues before they occur.
Do you feel like you’re contributing to helping keep our world secure and can you share why that matters to you?
I do, especially at a company like Amazon, whose global reach spans countless industries and touches millions of lives every day. Being mission-driven is deeply important to me, and I’m particularly drawn to the purpose of helping to protect the data, systems, and transactions that people depend on in their daily lives.
What positive change do you think will take place as we bring the next generation into the cybersecurity industry?
Gen Z and Gen Alpha have grown up as digital natives, always having smartphones, social media, or constant/instant communications. I believe their tech savviness and awareness of security and privacy issues will serve as both the source (workforce) and demand for better secure-by-default technology. I also think they will harness generative AI to build secure technology, in ways that are still being experimented with and tested now.
Who is your role model in the cybersecurity industry and why?
Jen Easterly, of course. From her educational pedigree to the impactful positions she’s held in her career to singing about cyber hygiene—she’s boldly been at the height of the cyber profession while being fun and relatable. She also maintains grace, dignity, and honor in challenging situations. My hat is off to her.
